New cxs v11.07


  • On DirectAdmin, enabled UI support for OpenLiteSpeed/LiteSpeed configuration
  • Updated –test to include cxscgi configuration on non-cPanel servers
  • Modified install.txt to make it even clearer that the EPEL is needed on most systems for the required perl modules
  • Improved domain document root lookups for Plesk when using –www

New csf v13.07


  • Added format requirements for ASN entries in CC_* settings
  • Removed SSHDSPAM exploit check as it’s no longer critically relevant
  • Modifications to support RHEL/CentOS v8
  • Modified systemd service to cater for RHEL/CentOS v7.7 pidfile symlink check changes
  • Fixes and improvements to UI Ajax code
  • Removed legacy bandmin code for cPanel servers and LF_CPANEL_BANDMIN setting
  • Modified default InterWorx csf.conf to set SMTP_ALLOWGROUP appropriately for SMTP_BLOCK

Official cxs InterWorx Support

We’re pleased to announce that our ConfigServer Exploit Scanner application is now fully supported on the InterWorx control panel. This means that installation is now included (see the cxs FAQ for conditions).

cxs exploit scanning:

  • Actively scans all modified files within user accounts using the cxs Watch daemon regardless of how they were uploaded
  • PHP upload scripts (via a ModSecurity hook)
  • Perl upload scripts (via a ModSecurity hook)
  • CGI upload scripts (via a ModSecurity hook)
  • Any other web script type that utilises the HTML form ENCTYPE multipart/form-data (via a ModSecurity hook)

The active scanning of files can help prevent exploitation of an account by malware by deleting or moving suspicious files to quarantine before they become active. It can also prevent the uploading of PHP and perl shell scripts, commonly used to launch more malicious attacks and for sending spam.

cxs also allows you to perform on-demand scanning of files, directories and user accounts for suspected exploits, viruses and suspicious resources (files, directories, symlinks, sockets). You can run scans of existing user data to see if exploits have been uploaded in the past or via methods not covered by the active scanning. It has been tuned for performance and scalability.

More information is available on the product page:

New cxs v11.05


  • InterWorx support is now out of beta and fully supported for the latest InterWorx on RHEL/CentOS/CL v6.* and v7.*
  • Removed redundant piping in various panel polling children
  • Fixed issue with IPv6 and retrieving the bayes database
  • Main decoder regex improvements
  • Include additional perl modules in the install.txt as well as sqlite
  • Successfully tested on CentOS v8.0

New cxs v11.04


  • Moved cxs in InterWorx to the Advanced section in Plugins UI
  • Improved system binary location checks
  • Deprecated pure-ftpd integration. The system provided for by pure-ftpd introduces excessive performance limitations and is of limited use compared to using cxs watch
  • Added cxs information option to UI for support purposes (it runs cxs –test)

New csf v13.06


  • Removed debugging code from log file globbing routine
  • Fixed reseller UI HTML text for each supported control panel
  • Replaced the need in InterWorx for a custom Firewall.php with a preAction to intercept calls instead
  • Moved csf in InterWorx to the Advanced section in Plugins UI
  • Updated the InterWorx plugin.ini information to be more descriptive

New cxs v11.03


  • Modified Plesk Onyx installation to check for supported OS and Plesk version for UI extension. If you want to disable installation of the Plesk UI extension, you can create a touch file as: /etc/cxs/cxs.disableui
  • Improvements to PHP string decoding
  • Updated control panel dependent install.txt files
  • Improvements to submitting exploits using –wttw (version check)

New csf v13.05


  • Added official CentOS Web Panel (CWP) integration and CWP panel specific configuration. See /etc/csf/readme.txt for more information (only tested on CentOS v7)
  • Added official VestaCP integration and VestaCP specific configuration (only tested on CentOS v7)
  • Additional entries to csf.pignore for new DirectAdmin installations
  • Corrected DirectAdmin UI link text
  • Fixed UI presentation HTML
  • Fixed vsftpd regex for single character date of the month
  • Modified Debian installation to detect ip(6)tables-legacy and use update-alternatives to switch to using them
  • Modified InterWorx installation to not use chattr on /etc/apf/apf stub which was preventing apf upgrading. The lfd daemon will now reapply the stub if needed
  • Modified Server Check on DA to get case-insensitive config from the binary rather than the directadmin.conf file
  • Modified csf warning text on cPanel DNSONLY servers regarding the smtpgidonlytweak to disable it from CLI as it is not currently possible from the DNSONLY WHM UI